SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
: P" R6 g3 U4 G% }2 Y& `详细说明：
Islogin //判断登录的方法

. b+ f! [6 Y& f# k7 isub islogin()
3 a7 {) ]+ X6 q! T0 s+ R0 G& R3 `
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

1 b/ v- k  m: K8 O6 wdim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

  x8 ~5 S) L4 a$ ]/ S$ B$ e/ _t2=sdcms.loadcookie("loginkey")
) ?+ i0 `9 Z6 P( p
' w! S3 X* _/ Mif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
; b- G  Z6 d3 O" l0 ^/ ~
4 k& f0 T4 J" B! d' l( ~- I//
8 L  |  ]! F: m+ R5 K+ O7 p$ b2 t
sdcms.go "login.asp?act=out"

exit sub

else

dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

4 Z0 E7 |: Y6 k. P% Jif ubound(data)<0 then
! L* ?; _7 H+ t7 B) o  o1 k9 s
* @! R4 ?! ]- O" Lsdcms.go "login.asp?act=out"
; g1 r% D9 `4 \( ~2 H$ O
3 c2 J: g  `- K* iexit sub
, D% A+ I1 z1 V
else
+ y# F4 S  H  H( Q' G; n: G
: [+ ]* o* ~# `if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"

, {2 G& h( J  o$ @' K' Z! mexit sub

5 m* h- |6 x& g% N8 {4 jelse

adminid=data(0,0)

/ T  Q# ]# C$ {: C) ^6 I) s" Ladminname=data(1,0)

admin_page_lever=data(5,0)

% m* R9 i- [$ A; ~6 _3 eadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

. }1 l+ s& E& R5 dif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
8 I& u- k; g/ }. y9 N. p8 E5 V
6 ?: t' I) B7 @, {- N7 s3 Yif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
8 W% C1 `& G. `8 ^
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
6 A& I4 O5 Q1 V. H% Z* |* w
admin_lever_where=" and menuid in("&admin_page_lever&")"
& @" ~' |9 L9 l$ a2 R! T$ A; s
9 @6 T; U7 n, N( v( O* _2 f5 Hend if
! J" ^/ G( r4 k/ @. Y' D0 r! \
/ L3 a5 Q& ]$ fsdcms.setsession "adminid",adminid
: g3 L1 q; e7 ^$ L7 F
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

6 R7 ^" D5 t+ }end if
0 V$ u  M2 }( j" c
end if
3 X& w, j: s, j* u+ ?4 W0 _" F
+ D6 T+ @7 {/ hend if
) }9 h3 [$ J; M* i
4 t2 h& B% p- Aelse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

( m4 O3 l- D! l) d0 yif ubound(data)<0 then

sdcms.go "login.asp?act=out"
7 h5 i$ k+ U* y+ L" y7 N/ o6 `
0 W0 M( x  E8 ?exit sub

else
% b& h- B5 a0 d; _; m# H
admin_page_lever=data(0,0)

admin_cate_array=data(1,0)
! E/ t) V$ Y/ V! n
) ?# W8 ~) c$ ]4 t* k+ Xadmin_cate_lever=data(2,0)
; b! `; P+ e, s0 M; t7 T
9 T  d& }; f0 Y7 Q; D3 K0 p: Kif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

9 V9 v! a- |) k; i0 C. Y* Yif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
- N% v: q. S7 W) j+ D
9 l0 w8 j0 q" N7 ^# E4 |if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ \* Y  _+ X7 b% B7 f- [# N6 y
if clng(admingroupid)<>0 then
/ |6 s' F: H/ l; K6 c
admin_lever_where=" and menuid in("&admin_page_lever&")"

, Z& _: R* V( a; b# Jend if
8 k4 ?- z$ C7 c' Z9 Y; i) I
' b, x9 Q* f/ s$ l% g) ?- l1 Q- jend if
7 @. @6 k. R8 p! d2 ^- p. z
1 s* |5 }. n2 ?5 Y( H/ Yend if

end sub
漏洞证明：
看看操作COOKIE的函数

2 \3 f! G0 Q: @3 K, {- p6 ?) vpublic function loadcookie(t0)

2 [" L0 E$ s8 a4 \loadcookie=request.cookies(prefix&t0)
3 C$ B% E7 a$ g$ g8 a) X
end function

. S, {/ T* H5 f2 b& |public sub setcookie(byval t0,byval t1)
. s" g3 V/ W) p* l  z- d
response.cookies(prefix&t0)=t1
, Z0 U$ `' Y) x% ]" y# t: _
end sub

" _- I3 u7 t2 C. O1 y  kprefix
/ j/ p# h+ g* s; S+ S- {# Z
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
) p4 T, a: K0 t0 b
1 s) z. B# q& cdim prefix
# R% f' t* m9 Z, {7 I
prefix="1Jb8Ob"
5 o0 |0 Y8 T& ?' z. j/ W
2 p; u5 \' w0 k, [4 n! a7 K& b'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

" }) l/ ]5 v7 D# s2 h$ Qsub out
# P& W/ D; v- s
sdcms.setsession "adminid",""

1 K" x! W" j1 H  P. Esdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

sdcms.go "login.asp"

) n" z  K1 a8 l6 hend sub

  K* y: \7 w! s* H( ]$ p
! Y) [7 i3 C. x2 C' `/ |3 q利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
, j3 Y* m9 h0 H% b9 u修复方案：
* c0 N: k( c! X% z修改函数！
: Z7 b5 n# \9 K! t3 E